DDoS & DoS

Study Notes

A Distributed Denial-of-Service (DDoS) attack disrupts normal traffic by overwhelming a target with an influx of internet traffic.
This attack utilizes multiple compromised computers and devices, forming a botnet to send requests simultaneously.
DDoS is like a traffic jam on a highway, preventing regular traffic from reaching its destination.

A botnet consists of compromised devices controlled remotely by an attacker.
Each infected device (bot) is instructed to send simultaneous requests to the target's IP address, leading to server overload and denial of service.
Attack traffic originating from legitimate devices makes identification difficult.

The most noticeable sign is a website or service abruptly becoming slow or unavailable.
Traffic analytics tools can help identify suspicious traffic patterns:
- Large amounts of traffic from a single IP or range.
- Traffic from users sharing identical behavioral profiles (device type, location, browser).
- Sudden increase in requests to a specific page or endpoint.
- Unusual traffic spikes at unexpected hours.
Other specific indicators may vary depending on the attack type.

DDoS is a subcategory of Denial-of-Service (DoS) attacks.
In DoS attacks, a single internet connection is used to barrage a target with bogus requests or exploit vulnerabilities.
DDoS differs by employing thousands or even millions of devices, making it larger in scale and significantly harder to combat.

A proactive defense involves combining attack surface reduction, threat monitoring, and scalable mitigation tools.
Attack surface reduction:
- Limit traffic to specific locations.
- Implement load balancers.
- Block communication from outdated or unused ports, protocols, and applications.
Anycast network diffusion:
- Disperses traffic across multiple servers, increasing surface area and absorbing traffic spikes.
Real-time, Adaptive Threat Monitoring:
- Log monitoring analyzes traffic patterns, identifies spikes, and adapts to defend against malicious requests.
Caching:
- Content delivery networks (CDNs) cache content, reducing server load and protecting against both legitimate and malicious requests.
Rate Limiting:
- Restricts traffic volume over a specific timeframe, preventing servers from being overwhelmed by requests from specific IP addresses.
DDoS Prevention Tools:
- Web Application Firewalls (WAFs): Filter, inspect, and block malicious HTTP traffic between web applications and the internet.

Botnet: A group of compromised devices
Bot: A single compromised device
CDN: Content Delivery Network
WAF: Web Application Firewall
Anycast: Network technology that allows a single IP address to represent multiple servers.
Rate Limiting: Controls the number of requests allowed from specific IP addresses per time period.